Cybersecurity teams worldwide have observed a surge in sophisticated campaigns exploiting both Windows and Linux vulnerabilities in recent months to achieve unauthorized system access.

These attacks often begin with phishing emails or malicious web content designed to deliver weaponized documents. Once opened, the embedded exploits target unpatched vulnerabilities in commonly used software components, allowing attackers to execute arbitrary code on victim machines.

As organizations struggle to keep pace with patch management, threat actors have intensified their focus on high-impact flaws that remain unaddressed in many environments.

Securelist researchers identified that several long-standing vulnerabilities in Microsoft Office’s Equation Editor continue to be a favorite initial access vector.

CVE-2018-0802 and CVE-2017-11882, both remote code execution flaws in the Equation Editor component, remain heavily exploited despite patches being available for years.

In addition, CVE-2017-0199, a flaw affecting Office and WordPad, provides another path for payload delivery.

These Office exploits are often combined with more recent Windows File Explorer and driver vulnerabilities—such as CVE-2025-24071, which enables NetNTLM credential theft via .library-ms files, and CVE-2024-35250, a ks.sys driver code execution issue—to establish a foothold and escalate privileges.

Beyond Microsoft Office, attackers have also leveraged WinRAR’s archive-handling weaknesses. CVE-2023-38831 and the directory traversal flaw CVE-2025-6218 allow adversaries to place malicious files outside the intended extraction path, hijacking system configurations or dropping persistence backdoors.

On the Linux side, the Dirty Pipe vulnerability (CVE-2022-0847) remains a critical favorite for privilege escalation, while CVE-2019-13272 and CVE-2021-22555 continue to be used to gain root access on unpatched servers.

Infection Mechanism

A particularly insidious infection mechanism combines Office-based delivery with secondary exploitation of system drivers. Securelist analysts noted that attackers craft RTF documents containing shellcode that invokes Equation Editor through OLE objects.

Once the vulnerability triggers, shellcode downloads a two-stage payload: a small loader and a full-featured malware binary.

The loader leverages CVE-2025-24071 to harvest NetNTLM hashes from incoming SMB connections, forwarding them to a C2 server.

The full payload then exploits CVE-2024-35250 to load a malicious driver into kernel space, granting attackers unrestricted code execution.

This dual-exploit chain allows adversaries to bypass user-level defenses and deploy rootkits undetected.

In many incidents, once kernel-level control is achieved, attackers install custom C2 frameworks—such as Sliver or Havoc—to maintain persistence.

These implants include in-memory protection to evade antivirus scans and use legitimate Windows services to blend into normal processes.

By chaining publicly known exploits, actors can rapidly move from initial compromise to full system control without writing suspicious files to disk.

Vulnerability Details:-

This consolidated view highlights the persistence of older vulnerabilities alongside newer flaws, underscoring the critical need for timely patching and comprehensive defense-in-depth strategies.

Organizations should prioritize updates for both user applications and system components to mitigate the risk of these prevalent exploits in real-world attacks.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Threat Actors Leveraging Windows and Linux Vulnerabilities in Real-world Attacks to Gain System Access appeared first on Cyber Security News.

Over the past year, security researchers have observed a growing trend of North Korean–linked developers establishing credible-looking profiles on popular code-sharing platforms such as GitHub, CodeSandbox, and Gist.

These accounts frequently host legitimate open-source projects alongside hidden payloads, allowing operators to mask malicious activity under the guise of normal developer contributions.

The overall goal appears to be multifaceted: generating revenue for state-sponsored programs, obtaining access to remote work contracts, and using those engagements as beachheads for more sophisticated cyber operations.

Initially, these profiles attracted attention due to unusually high activity levels and the adoption of advanced software stacks—including React.js front ends, Node.js back ends, and Dockerized deployment configurations—designed to impress prospective clients.

However, a deeper analysis revealed carefully obfuscated modules within certain repositories that leveraged compromised dependencies to deliver remote access trojans.

THE RAVEN FILE analysts noted that these repositories often employed minimalistic README files to distract from hidden directories named .secret or .vendor where malicious payloads were staged.

The impact of these operations has been significant. Several victims unknowingly installed tainted packages during routine dependency updates, granting attackers persistent access to corporate networks or cloud environments.

In one documented case, a financial services firm imported a library called @jupyter-utils/rpc that contained a loader script intercepting WebSocket connections and exfiltrating credentials via an embedded C2 channel.

The combination of legitimate functionality and covert communication made detection extremely difficult for standard signature-based scanners.

Infection Mechanism and Persistence Tactics

A closer look at the infection mechanism reveals a multi-stage loader that activates only when certain environmental conditions are met.

Upon installation, the malicious package executes a preinstall script defined in package.json:-

"scripts": {
  "preinstall": "node scripts/setup.js"
}

The setup.js module then checks for the presence of common CI/CD directories (.gitlab-ci, .github/workflows) before deploying an encrypted payload into the application’s runtime directory.

This payload, stored as payload.enc, is decrypted in memory using a hard-coded key and immediately executed via Node’s vm module:-

const vm = require('vm');
const fs = require('fs');
const key = Buffer.from(process.env.DEPLOY_KEY, 'hex');
const cipher = fs.readFileSync('./payload.enc');
const decrypted = decrypt(cipher, key);
vm.runInThisContext(decrypted);

This below figure illustrates how the primary repository README masks the scripts folder, while Figure 2 (“deepfake_result.png”) shows the deepfake profile image used to enhance credibility.

By embedding itself at the package manager level and leveraging CI/CD hooks, the malware achieves both stealthy installation and persistence.

Removal requires thorough dependency audits and validation of all installation scripts.

As organizations increasingly rely on open-source components, understanding these infection vectors is critical to safeguarding supply chains and maintaining trust in collaborative development platforms.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post DPRK IT Workers Using Code-Sharing Platforms to Secure New Remote Jobs appeared first on Cyber Security News.

Cybersecurity researchers have uncovered a sophisticated malvertising campaign on Meta’s Facebook platform in recent weeks that targets Android users with promises of a free TradingView Premium application.

These deceptive ads mimic official TradingView branding and visuals, luring unsuspecting victims to download what appears to be a legitimate APK.

Once installed, however, the app unleashes a highly advanced crypto-stealing trojan that leverages accessibility abuses and overlay techniques to harvest credentials, bypass two-factor authentication, and seize control of device functionality.

This campaign marks a significant evolution in mobile-focused malvertising, demonstrating how threat actors adapt traditional desktop-oriented strategies to increasingly lucrative Android ecosystems.

After initial discovery on July 22, 2025, the wave of malicious advertisements rapidly gained traction across Europe and beyond.

The ads redirect users to a cloned webpage at new-tw-view[.]online, where they download an APK from tradiwiw[.]online/tw-update.apk.

Upon installation, the dropper immediately requests powerful permissions, masquerading as legitimate update prompts that coax users into enabling Accessibility Services and granting device administration rights.

Bitdefender analysts noted that, in many cases, the dropper cleans up after itself by uninstalling its initial stub, leaving only the payload in place to avoid detection.

On August 22, Bitdefender researchers identified that at least 75 unique ads had been deployed since late July, reaching tens of thousands of users in the EU alone.

The attackers localized their lures in over a dozen languages—including Vietnamese, Portuguese, Spanish, Turkish, and Arabic—to maximize reach and credibility.

Targeting mobile users reflects a broader trend: as smartphones become central to financial operations—crypto wallets, mobile banking, and authentication apps—the stakes for successful compromise rise dramatically.

Technical Overview of Infection Mechanism

Delving into the infection chain reveals a multi-stage process designed for stealth and persistence. Upon execution, the dropper APK computes the MD5 checksum 788cb1965585f5d7b11a0ca35d3346cc and unpacks an embedded payload with checksum 58d6ff96c4ca734cd7dfacc235e105bd.

The payload is stored as an encrypted DEX resource within the application. A native library dynamically retrieves decryption keys and loads the hidden classes via reflection, bypassing standard signature checks.

// Reflection-based payload loading
String dexPath = context.getFilesDir() + "/payload.dex";
FileOutputStream fos = new FileOutputStream(dexPath);
fos.write(decryptedBytes);
fos.close();
DexClassLoader loader = new DexClassLoader(dexPath, context.getCacheDir().getAbsolutePath(), null, context.getClassLoader());
Class<?> clazz = loader.loadClass("com.tradingview.updater.Updater");
Method init = clazz.getMethod("initialize", Context.class);
init.invoke(null, context);

Once active, the malware registers as an accessibility service, granting it the ability to monitor keystrokes, intercept 2FA tokens from Google Authenticator, and display fake login screens over banking and crypto apps.

The code snippet above exemplifies how the malicious updater class is dynamically loaded, ensuring that static analysis tools may miss its presence.

Persistence is achieved by re-enabling accessibility services on reboot and hiding its icon from app drawers through PackageManager.setComponentEnabledSetting, preventing user attempts to locate and remove the threat.

This attack demonstrates a high degree of automation combined with manual-grade precision in targeting high-value assets on Android devices.

By weaponizing Facebook’s ad infrastructure and leveraging in-depth knowledge of the Android permission model, threat actors have created a potent campaign capable of global reach and significant financial impact.

Organizations and individuals alike must remain vigilant, scrutinizing app sources, verifying URLs, and limiting sideloading to trusted repositories.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Threat Actors Weaponizing Facebook Ads with Free TradingView Premium App Lures That Delivers Android Malware appeared first on Cyber Security News.